Order comes from the transaction index
At each level, an even index places the current hash on the left; an odd index places it on the right. The index then shifts right by one bit.
Tools · Privacy-first
Merkle Proof Verifier
Recompute a Bitcoin Merkle branch from a transaction ID or 32-byte leaf hash. Compare the result with an expected Merkle root, the commitment inside an optional 80-byte block header, or both.
A matching branch proves only that the supplied leaf and path produce the supplied root. It does not validate header proof of work, active-chain membership, confirmations, transaction validity, or block acceptance.
Runs locally
Your proof data stays in this browser.
Local input: A transaction ID or leaf hash, zero-based transaction index, Merkle branch siblings, and optional expected root or serialized block header. Network effect: None when verifying. Proof data is processed in this page and is not sent to BitcoinStats, a node, an explorer, analytics, browser storage, or the URL.
Leaf + branchBrowser SHA-256dRoot comparison
After the page assets load, verification works offline. Inputs are not added to the URL, browser storage, analytics, or a server request.
Local input
Describe the proof
Use conventional displayed big-endian hashes. Add branch siblings from leaf level upward, one hash per line. The zero-based transaction index determines whether each sibling is hashed on the left or right.
Nothing is uploaded. Verification starts only when you press “Verify locally”.
Verification result
Merkle commitment
Computed values
Root and header
Commitments
What was actually checked
Branch path
SHA-256d calculation
Purpose and limits
Verify the commitment without overstating it
Bitcoin uses double SHA-256
Displayed hashes are reversed to Bitcoin’s serialized byte order before each pair is hashed. The final digest is reversed back for conventional display.
A header is still not a chain proof
The optional header lets this tool compare its embedded root and show its hash. No difficulty target, proof of work, header chain, or current best-chain lookup is performed.
This verifier accepts an ordinary transaction Merkle branch. It does not accept partial-merkle-block serialization, witness commitments, or a coinbase witness reserved value.